tests/lang/bug24773.phpt, segfault with 4.3.5RC2

Hello, I got segfaults with the test tests/lang/bug24773.phpt. It seems the test added in HEAD has been either lost or never applied. Please find an attempt to fix as attachment, feel free to drop it and apply your own and cleaner one ;-) hth pierre

--- /home/paj/cvs/php43/Zend/zend_execute.c 2004-02-05 16:19:26.000000000 +0100 +++ Zend/zend_execute.c 2004-02-05 16:18:40.000000000 +0100 @@ -1310,11 +1310,16 @@ binary_assign_op_addr: { } */ zend_fetch_dimension_address(&EX(opline)->result, &EX(opline)->op1, &EX(opline)->op2, EX(Ts), BP_VAR_R TSRMLS_CC); - PZVAL_UNLOCK(*EX(Ts)[EX(opline)->result.u.var].var.ptr_ptr); - if (EX(Ts)[EX(opline)->result.u.var].var.ptr_ptr != &EG(uninitialized_zval_ptr)) { - SEPARATE_ZVAL_IF_NOT_REF(EX(Ts)[EX(opline)->result.u.var].var.ptr_ptr); - } - PZVAL_LOCK(*EX(Ts)[EX(opline)->result.u.var].var.ptr_ptr); + + if (!EX(Ts)[EX(opline)->result.u.var].var.ptr_ptr) { + zend_error(E_ERROR, "Cannot unset string offsets"); + } else { + PZVAL_UNLOCK(*EX(Ts)[EX(opline)->result.u.var].var.ptr_ptr); + if (EX(Ts)[EX(opline)->result.u.var].var.ptr_ptr != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(EX(Ts)[EX(opline)->result.u.var].var.ptr_ptr); + } + PZVAL_LOCK(*EX(Ts)[EX(opline)->result.u.var].var.ptr_ptr); + } NEXT_OPCODE(); case ZEND_FETCH_OBJ_R: zend_fetch_property_address(&EX(opline)->result, &EX(opline)->op1, &EX(opline)->op2, EX(Ts), BP_VAR_R TSRMLS_CC);